Critical 7-Zip Vulnerability Allows Attackers to Bypass Windows Security Features

7-Zip Users Urged to Update Immediately to Fix High-Severity Vulnerability

A recently discovered vulnerability in the popular open-source file archiver 7-Zip exposes users to significant security risks by allowing attackers to bypass the Windows Mark of the Web (MotW) security feature. This vulnerability, tracked as CVE-2025-0411, has been addressed in version 24.09 of 7-Zip, but many users remain at risk if they do not update promptly.

Understanding the Threat

Mark of the Web (MotW) is a critical Windows security feature that flags files downloaded from the internet or other untrusted sources. This flag restricts how these files can be executed, helping to prevent accidental malware infections. For instance, MotW can trigger warning messages when risky files are opened or cause Microsoft Office to open documents in Protected View.

However, the flaw in 7-Zip allows attackers to bypass this safeguard. The vulnerability stems from 7-Zip’s failure to propagate the MotW flag when extracting files from nested archives, leaving users exposed to potential malware execution.

According to an advisory from the Trend Micro Zero Day Initiative (ZDI):

“This vulnerability allows remote attackers to bypass the Mark-of-the-Web protection mechanism on affected installations of 7-Zip. User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file.”

Exploiting the Vulnerability

Threat actors can exploit this flaw by crafting malicious archives. If a user extracts files from these archives using a vulnerable version of 7-Zip, the extracted files will lack the MotW flag, enabling malware execution without security warnings.

Such attacks typically involve social engineering tactics, such as tricking users into downloading archives from phishing emails, malicious websites, or fake software download links.

Mitigation: Update to 7-Zip Version 24.09

Igor Pavlov, the developer of 7-Zip, patched the vulnerability on November 30, 2024, with the release of version 24.09. The update ensures that MotW flags are correctly propagated, even for files extracted from nested archives.

As highlighted in the release notes:

“7-Zip File Manager didn’t propagate Zone.Identifier stream for extracted files from nested archives (if there is open archive inside another open archive).”

Important Note: 7-Zip does not include an auto-update feature, meaning users must manually download and install the latest version from the official 7-Zip website or from ToolsLib download page.

Risks of Not Updating

Users who continue to use outdated versions of 7-Zip are highly susceptible to exploitation. Malware operators have historically exploited similar vulnerabilities to deploy malicious payloads, such as:

1. DarkGate Malware: Leveraged a MotW bypass (CVE-2024-38213) to install disguised malware on victims’ systems.
2. DarkMe RAT: Distributed via MotW bypass vulnerabilities (CVE-2024-21412) to target stock trading forums and Telegram channels.

These incidents underscore the importance of promptly addressing security flaws like CVE-2025-0411.

What Should You Do?

1. Update Immediately: If you use 7-Zip, download version 24.09 or later from the official website.
2. Verify Downloads: Always ensure you download software from trusted sources.
3. Be Cautious with Archives: Avoid extracting files from untrusted or suspicious sources, especially if you haven’t updated 7-Zip.
4. Enable Security Features: Keep your operating system and antivirus software up to date to provide additional layers of protection.

Conclusion

The CVE-2025-0411 vulnerability highlights the evolving strategies of threat actors and the critical need for timely software updates. While 7-Zip remains a valuable tool for millions of users, it is imperative to stay informed and vigilant about security risks. By updating to version 24.09, users can protect themselves from potential attacks exploiting this flaw.

Stay safe, and ensure your software is always up to date!

7-Zip Official Website